Jeremy Daer 4efa4da809 Fix IDOR in webhook activation endpoint (#2431) ...

The webhook activation controller was using account-scoped lookup
instead of board-scoped lookup, allowing users to reactivate webhooks
on boards they don't have access to.

This was an oversight when board-scoping was added to the main webhooks
controller - the activations controller was missed in that update.

The fix adds the BoardScoped concern to properly restrict webhook
activation to boards the user has explicit access to.

2026-01-24 17:06:12 -08:00

..

account

Add self-service account deletion (#2246)

2026-01-12 14:21:05 +01:00

accounts

Add validation for the join code usage limit

2025-12-10 10:10:08 -05:00

active_storage

Require authorization for direct uploads

2025-12-23 11:08:51 +01:00

admin

Add billing system with Stripe

2025-12-16 16:44:20 +01:00

boards

update columns controller destroy test

2025-12-11 10:49:05 +01:00

cards

Add card reactions to API docs and reactions_url to card JSON (#2427)

2026-01-23 16:55:50 -05:00

columns

update tests

2025-12-11 10:36:56 +01:00

concerns

Support local installations where the app is loaded over HTTP

2026-01-05 18:50:14 +01:00

events/day_timeline

Update test

2025-11-24 12:04:33 +01:00

my

Add self-service account deletion (#2246)

2026-01-12 14:21:05 +01:00

notifications

Add API for reading notifications

2025-12-10 09:23:52 +01:00

prompts

Constrain user queries to the current or relevant account

2025-11-17 09:11:57 -05:00

public

Show only public cards on public boards

2025-12-15 13:15:36 +01:00

searches

Format

2025-06-24 13:26:37 +02:00

sessions

Add self-service account deletion (#2246)

2026-01-12 14:21:05 +01:00

signup

Add a test

2025-12-20 18:12:42 -06:00

users

Redirect back to account settings page when the user role is changed or when the user is removed from an account.

2025-12-22 10:47:23 +02:00

webhooks

Fix IDOR in webhook activation endpoint (#2431)

2026-01-24 17:06:12 -08:00

allow_browser_test.rb

Update useragent to recognize twitterbot/facebot

2025-11-25 18:05:21 -05:00

api_test.rb

Split tests by controller or responsibility

2025-12-19 19:21:57 +01:00

boards_controller_test.rb

🐛 fix: resolve stale account names in jump menu and page titles

2025-12-15 15:59:25 +08:00

cards_controller_test.rb

Add card reactions to API docs and reactions_url to card JSON (#2427)

2026-01-23 16:55:50 -05:00

controller_authentication_test.rb

Remove the internal API

2025-10-31 16:26:08 +01:00

events_controller_test.rb

Baseline replacing collection with board across code

2025-11-05 13:31:54 +01:00

filters_controller_test.rb

Make IDs more time-sortable in tests

2025-11-17 09:12:40 -05:00

join_codes_controller_test.rb

feat: add rate limit to join codes controller

2025-12-12 17:21:57 +01:00

landings_controller_test.rb

Redirect to root to avoid changing the path by default

2025-11-05 19:00:50 +01:00

notifications_controller_test.rb

Add API for reading notifications

2025-12-10 09:23:52 +01:00

qr_codes_controller_test.rb

Add QrCodesController test

2025-12-11 13:51:18 -05:00

searches_controller_test.rb

prefactor: update search to use published cards

2026-01-23 11:07:43 -05:00

sessions_controller_test.rb

Split tests by controller or responsibility

2025-12-19 19:21:57 +01:00

signups_controller_test.rb

Use initializer to configure tenant mode

2025-12-11 11:20:43 +00:00

tags_controller_test.rb

Add pagination to most places and fix cards pagination

2025-12-10 09:23:52 +01:00

users_controller_test.rb

Redirect back to account settings page when the user role is changed or when the user is removed from an account.

2025-12-22 10:47:23 +02:00

webhooks_controller_test.rb

Fix IDOR in webhook activation endpoint (#2431)

2026-01-24 17:06:12 -08:00